breach-notification-ui

name	breach-notification-ui
description	Use when designing the UI for a security breach notification (rare but high-stakes). Covers tone, what to disclose, the in-app banner + email + status page pattern, and the legal requirements that affect design.

Breach Notification Ui

Breach notification is the highest-stakes UI you'll ever design. Get it right by being honest, fast, and specific.

Timing

Most jurisdictions require notification within 72 hours of confirmed breach. Design assumes this clock is running.

Channels

In-app banner (sticky, dismissible after read) + email (to all affected) + status page update + dedicated incident page. Same message across all.

What to disclose

What happened. When it happened. What data was affected. What you've done. What customer should do. Contact for questions. Acknowledged without legal hedging.

Tone

Direct, accountable, specific. NEVER 'we take security seriously' boilerplate. NEVER passive voice ('mistakes were made').

Follow-up

Post-mortem published within 30 days. Action items. Public.atus updates as situation evolves.

Common mistakes

Hiding the notice. Legal-edited into uselessness. Passive voice ('an unauthorized party gained access'). No specific affected-data description. 'We take this seriously' platitudes. No acknowledgment of trust damaged.

Where this fits in X3 Compass

Applied in the X3 Compass build via the relevant pages and components.